🔍

ANS-C01 — questions

Page 7 of 15 · 292 total questions.

ANS-C01 Question 121

Single page →
Topic 1 · Question 121

An application team for a startup company is deploying a new multi-tier application into the AWS Cloud. The application will be hosted on a fleet of Amazon EC2 instances that run in an Auto Scaling group behind a publicly accessible Network Load Balancer (NLB). The application requires the clients to work with UDP traffic and TCP traffic. In the near term, the application will serve only users within the same geographic location. The application team plans to extend the application to a global audience and will move the deployment to multiple AWS Regions around the world to bring the application closer to the end users. The application team wants to use the new Regions to deploy new versions of the application and wants to be able to control the amount of traffic that each Region receives during these rollouts. In addition, the application team must minimize first-byte latency and jitter (randomized delay) for the end users. How should the application team design the network architecture for the application to meet these requirements?

  • ACreate an Amazon CloudFront distribution to align to each Regional deployment. Set the NLB for each Region as the origin for each CloudFront distribution. Use an Amazon Route 53 weighted routing policy to control traffic to the newer Regional deployments.
  • BCreate an AWS Global Accelerator accelerator and listeners for the required ports. Configure endpoint groups for each Region. Configure a traffic dial for the endpoint groups to control traffic to the newer Regional deployments. Register the NLBs with the endpoint groups. (correct answer)
  • CUse Amazon S3 Transfer Acceleration for the application in each Region. Adjust the amount of traffic that each Region receives from the Transfer Acceleration endpoints to the Regional NLBs.
  • DCreate an Amazon CloudFront distribution that includes an origin group. Set the NLB for each Region as the origins for the origin group. Use an Amazon Route 53 latency routing policy to control traffic to the new Regional deployments.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an AWS Global Accelerator accelerator and listeners for the required ports. Configure endpoint groups for each Region. Configure a traffic dial for the endpoint groups to control traffic to the newer Regional d...

Explanation

AWS Global Accelerator routes users over the AWS backbone to the optimal endpoint for lower latency and fast failover. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 122

Single page →
Topic 1 · Question 122 · Select all that apply

A company is deploying a new stateless web application on AWS. The web application will run on Amazon EC2 instances in private subnets behind an Application Load Balancer. The EC2 instances are in an Auto Scaling group. The web application has a stateful management application for administration that will run on EC2 instances that are in a separate Auto Scaling group. The company wants to access the management application by using the same URL as the web application, with a path prefix of/management. The protocol, hostname, and port number must be the same for the web application and the management application. Access to the management application must be restricted to the company's on-premises IP address space. An SSL/TLS certificate from AWS Certificate Manager (ACM) will protect the web application. Which combination of steps should a network engineer take to meet these requirements? (Choose two.)

  • AInsert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is a match. Edit the management application target group and enable stickiness. (correct answer)
  • BModify the default rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the management application target group if there is not a match. Enable group-level stickiness in the rule attributes.
  • CInsert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the X-Forwarded-For HTTP header for the on-premises IP address space. Forward requests to the management application target group if there is a match. Enable group-level stickiness in the rule attributes.
  • DModify the default rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space. Forward requests to the web application target group if there is not a match.
  • EForward all requests to the web application target group. Edit the web application target group and disable stickiness. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Insert a rule for the load balancer HTTPS listener. Configure the rule to check the path-pattern condition type for the /management prefix and to check the source-ip condition type for the on-premises IP address space... Option E: Forward all requests to the web application target group. Edit the web application target group and disable stickiness.

Explanation

A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 123

Single page →
Topic 1 · Question 123 · Select all that apply

A company deploys a software solution on Amazon EC2 instances that are in a cluster placement group. The solution's UI is a single HTML page. The HTML file size is 1,024 bytes. The software processes files that exceed 1,024 MB in size. The software shares files over the network to clients upon request. The files are shared with the Don't Fragment flag set. Elastic network interfaces of the EC2 instances are set up with jumbo frames. The UI is always accessible from all allowed source IP addresses, regardless of whether the source IP addresses are within a VPC, on the internet, or on premises. However, clients sometimes do not receive files that they request because the files fail to travel successfully from the software to the clients. Which options provide a possible root cause of these failures? (Choose two.)

  • AThe source IP addresses are from on-premises hosts that are routed over AWS Direct Connect.
  • BThe source IP addresses are from on-premises hosts that are routed over AWS Site-to-Site VPN. (correct answer)
  • CThe source IP addresses are from hosts that connect over the public internet. (correct answer)
  • DThe security group of the EC2 instances does not allow ICMP traffic.
  • EThe operating system of the EC2 instances does not support jumbo frames.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: The source IP addresses are from on-premises hosts that are routed over AWS Site-to-Site VPN. Option C: The source IP addresses are from hosts that connect over the public internet.

Explanation

AWS Site-to-Site VPN provides encrypted connectivity between on premises and a VPC.

ANS-C01 Question 124

Single page →
Topic 1 · Question 124

A company has users who work from home. The company wants to move these users to Amazon WorkSpaces for additional security visibility. The company has deployed WorkSpaces in its own AWS account in VPC A. A network engineer decides to provide the security visibility by using two firewall appliances behind a Gateway Load Balancer (GWLB). The network engineer provisions another VPC, VPC B, in a separate account and deploys the two firewall appliances in separate Availability Zones. What should the network engineer do to configure the network connectivity for this solution?

  • ACreate a GWLB in VPC A with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the default route to the VPC endpoint.
  • BCreate a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the default route to the GWLB endpoint. (correct answer)
  • CCreate a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the WorkSpaces subnet to the VPC endpoint.
  • DCreate a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the account that contains the firewall appliances to the principal allow list of the GWLB endpoint. In the WorkSpaces account, create a VPC endpoint and specify the service name that the AWS Management Console provides for the GWLB endpoint. Modify the route tables of VPC A to point the default route to the VPC endpoint.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a GWLB in VPC B with the firewall appliance instances as targets. Use the GWLB to create a GWLB endpoint. Add the AWS principal ARN of the WorkSpaces account to the principal allow list of the GWLB endpoint. In...

Explanation

A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

ANS-C01 Question 125

Single page →
Topic 1 · Question 125

A company plans to run a computationally intensive data processing application on AWS. The data is highly sensitive. The VPC must have no direct internet access, and the company has applied strict network security to control access. Data scientists will transfer data from the company's on-premises data center to the instances by using an AWS Site-to-Site VPN connection. The on-premises data center uses the network range 172.31.0.0/20 and will use the network range 172.31.16.0/20 in the application VPC. The data scientists report that they can start new instances of the application but that they cannot transfer any data from the on-premises data center. A network engineer enables VPC flow logs and sends a ping to one of the instances to test reachability. The flow logs show the following: The network engineer must recommend a solution that will give the data scientists the ability to transfer data from the on-premises data center. Which solution will meet these requirements?

Exhibit 1 for question 125
  • AModify the security group for the application. Add an inbound rule to allow traffic from the on-premises data center network range to the application.
  • BModify the network ACLs for the VPC subnet. Add an inbound rule to allow traffic from the on-premises data center network range to the VPC subnet range.
  • CModify the network ACLs for the VPC subnet. Add an outbound rule to allow traffic from the VPC subnet range to the on-premises data center network range. (correct answer)
  • DModify the security group for the application. Add an outbound rule to allow traffic from the application to the on-premises data center network range.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Modify the network ACLs for the VPC subnet. Add an outbound rule to allow traffic from the VPC subnet range to the on-premises data center network range.

ANS-C01 Question 126

Single page →
Topic 1 · Question 126

A company needs to temporarily scale out capacity for an on-premises application and wants to deploy new servers on Amazon EC2 instances. A network engineer must design the networking solution for the connectivity and for the application on AWS. The EC2 instances need to share data with the existing servers in the on-premises data center. The servers must not be accessible from the internet. All traffic to the internet must route through the firewall in the on-premises data center. The servers must be able to access a third-party web application. Which configuration will meet these requirements?

  • ACreate a VPC that has public subnets and private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a NAT gateway in a public subnet. Create a route table, and associate the public subnets with the route table. Add a default route to the internet gateway. Create a route table, and associate the private subnets with the route table. Add a default route to the NAT gateway. Add routes for the data center subnets to the virtual private gateway. Deploy the application to the private subnets.
  • BCreate a VPC that has private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the private subnets with the route table. Add a default route to the virtual private gateway. Deploy the application to the private subnets. (correct answer)
  • CCreate a VPC that has public subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the public subnets with the route table. Add a default route to the internet gateway. Add routes for the on-premises data center subnets to the virtual private gateway. Deploy the application to the public subnets.
  • DCreate a VPC that has public subnets and private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the public subnets with the route table. Add a default route to the internet gateway. Create a route table, and associate the private subnets with the route table. Add routes for the on-premises data center subnets to the virtual private gateway. Deploy the application to the private subnets.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a VPC that has private subnets. Create a customer gateway, a virtual private gateway, and an AWS Site-to-Site VPN connection. Create a route table, and associate the private subnets with the route table. Add a...

Explanation

AWS Site-to-Site VPN provides encrypted connectivity between on premises and a VPC.

ANS-C01 Question 127

Single page →
Topic 1 · Question 127

A company is deploying a web application into two AWS Regions. The company has one VPC in each Region. Each VPC has three Amazon EC2 instances as web servers behind an Application Load Balancer (ALB). The company already has configured an Amazon Route 53 public hosted zone for example.com. Users will access the application by using the fully qualified domain name (FQDN) of app.example.com. The company needs a DNS solution that allows global users to access the application. The solution must route the users' requests to the Region that provides the lowest response time. The solution must fail over to the Region that provides the next-lowest response time if the application is unavailable in the initially intended Region. Which solution will meet these requirements?

  • AFor each ALB, create an A record that has a geolocation routing policy to route app.example.com to the IP addresses of the ALB. Configure a Route 53 HTTP health check that monitors each ALB by IP address. Associate the health check with the A records.
  • BCreate an A record that has a geolocation routing policy to route app.example.com to the IP addresses for both ALBs. Configure a Route 53 health check that monitors TCP port 80 for each ALB by IP address. Associate the health check with the A records.
  • CCreate an A record that has a latency-based routing policy to route app.example.com as an alias to one of the ALBs. Configure a Route 53 health check that monitors TCP port 80 for each ALB by IP address. Associate the health check with the A records.
  • DFor each ALB, create an A record that has a latency-based routing policy to route app.example.com as an alias to the ALB. Set the value for Evaluate Target Health to Yes for the records. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: For each ALB, create an A record that has a latency-based routing policy to route app.example.com as an alias to the ALB. Set the value for Evaluate Target Health to Yes for the records.

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover.

ANS-C01 Question 128

Single page →
Topic 1 · Question 128

A consulting company manages AWS accounts for its customers. One of the company's customers needs to add intrusion prevention for its environment without having to re-architect the environment. The customer's environment includes five VPCs in two AWS Regions in the United States. VPC-to-VPC connectivity is achieved through VPC peering. The customer does not plan to increase the number of VPCs within the next 2 years. The solution must accommodate unencrypted traffic. Which solution will meet these requirements?

  • AConfigure VPC security groups and network ACLs.
  • BUse an AWS Network Firewall centralized deployment model in each VPC.
  • CUse an AWS Network Firewall distributed deployment model in each VPC. (correct answer)
  • DDeploy AWS Shield in each VPC.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use an AWS Network Firewall distributed deployment model in each VPC.

ANS-C01 Question 129

Single page →
Topic 1 · Question 129

A company hosts its IT infrastructure in an on-premises data center. The company wants to migrate the infrastructure to the AWS Cloud in phases. A network engineer wants to set up a 10 Gbps AWS Direct Connect dedicated connection between the on-premises data center and VPCs. The company's network provider needs 3 months to provision the Direct Connect connection. In the meantime, the network engineer implements a temporary solution by deploying an AWS Site-to-Site VPN connection that terminates to a virtual private gateway. The network engineer observes that the bandwidth of the Site-to-Site VPN connection is capped at 1.25 Gbps despite a powerful customer gateway device. What should the network engineer do to improve the VPN connection bandwidth before the implementation of the Direct Connect connection?

  • AContact AWS Support to request a bandwidth quota increase for the existing Site-to-Site VPN connection.
  • BDiscuss the issue with the hardware vendor. Buy a bigger and more powerful customer gateway device that has faster encryption and decryption capabilities.
  • CCreate several additional Site-to-Site VPN connections that terminate on the same virtual gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously.
  • DCreate a transit gateway. Attach the VPCs to the transit gateway. Create several additional Site-to-Site VPN connections that terminate on the transit gateway. Configure equal-cost multi-path (ECMP) routing to use all the VPN connections simultaneously. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a transit gateway. Attach the VPCs to the transit gateway. Create several additional Site-to-Site VPN connections that terminate on the transit gateway. Configure equal-cost multi-path (ECMP) routing to use all...

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. AWS Site-to-Site VPN provides encrypted connectivity between on premises and a VPC. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 130

Single page →
Topic 1 · Question 130

A company has business operations in the United States and in Europe. The company's public applications are running on AWS and use three transit gateways. The transit gateways are located in the us-west-2, us-east-1, and eu-central-1 Regions. All the transit gateways are connected to each other in a full mesh configuration. The company accidentally removes the route to the eu-central-1 VPCs from the us-west-2 transit gateway route table. The company also accidentally removes the route to the us-west-2 VPCs from the eu-central-1 transit gateway route table. How can a network engineer identify the misconfiguration with the LEAST operational overhead?

  • AUse the Route Analyzer feature for AWS Transit Gateway Network Manager. (correct answer)
  • BUse the AWSSupport-SetupIPMonitoringFromVPC AWS Systems Manager Automation runbook. Push network telemetry data to Amazon CloudWatch Logs for analysis.
  • CUse VPC flow logs in eu-central-1 and us-west-2 to analyze the missing routes.
  • DUse Amazon VPC Traffic Mirroring in eu-central-1 or us-west-2 to take packet captures and troubleshoot the connectivity issues.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use the Route Analyzer feature for AWS Transit Gateway Network Manager.

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale.

ANS-C01 Question 131

Single page →
Topic 1 · Question 131

A marketing company is using hybrid infrastructure through AWS Direct Connect links and a software-defined wide area network (SD-WAN) overlay to connect its branch offices. The company connects multiple VPCs to a third-party SD-WAN appliance transit VPC within the same account by using AWS Site-to-Site VPNs. The company is planning to connect more VPCs to the SD-WAN appliance transit VPC. However, the company faces challenges of scalability, route table limitations, and higher costs with the existing architecture. A network engineer must design a solution to resolve these issues and remove dependencies. Which solution will meet these requirements with the LEAST amount of operational overhead?

  • AConfigure a transit gateway to attach the VPCs. Configure a Site-to-Site VPN connection between the transit gateway and the third-party SD-WAN appliance transit VPC. Use the SD-WAN overlay links to connect to the branch offices.
  • BConfigure a transit gateway to attach the VPCs. Configure a transit gateway Connect attachment for the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD-WAN virtual hubs with AWS Transit Gateway. (correct answer)
  • CConfigure a transit gateway to attach the VPCs. Configure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPUse the SD-WAN overlay links to connect to the branch offices.
  • DConfigure VPC peering between the VPCs and the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD-WAN virtual hubs with AWS Transit Gateway.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure a transit gateway to attach the VPCs. Configure a transit gateway Connect attachment for the third-party SD-WAN appliance transit VPC. Use transit gateway Connect native integration of SD-WAN virtual hubs wi...

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 132

Single page →
Topic 1 · Question 132

A company is running a hybrid cloud environment. The company has multiple AWS accounts as part of an organization in AWS Organizations. The company needs a solution to manage a list of IPv4 on-premises hosts that will be allowed to access resources in AWS. The solution must provide version control for the list of IPv4 addresses and must make the list available to the AWS accounts in the organization. Which solution will meet these requirements?

  • ACreate a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the managed prefix list to the resource share. Share the resource with the organization. (correct answer)
  • BCreate a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Use AWS Firewall Manager to share the managed prefix list with the organization.
  • CCreate a security group. Add inbound rule entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the security group to the resource share. Share the resource with the organization.
  • DCreate an Amazon DynamoDB table. Add entries for the initial list of on-premises IPv4 hosts. Create an AWS Lambda function that assumes a role in each AWS account in the organization to authorize inbound rules on security groups based on entries from the DynamoDB table.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a customer-managed prefix list. Add entries for the initial list of on-premises IPv4 hosts. Create a resource share in AWS Resource Access Manager. Add the managed prefix list to the resource share. Share the r...

ANS-C01 Question 133

Single page →
Topic 1 · Question 133 · Select all that apply

A company's application is deployed on Amazon EC2 instances in a single VPC in an AWS Region. The EC2 instances are running in two Availability Zones. The company decides to use a fleet of traffic inspection instances from AWS Marketplace to inspect traffic between the VPC and the internet. The company is performing tests before the company deploys the architecture into production. The fleet is located in a shared inspection VPC behind a Gateway Load Balancer (GWLB). To minimize the cost of the solution, the company deployed only one inspection instance in each Availability Zone that the application uses. During tests, a network engineer notices that traffic inspection works as expected when the network is stable. However, during maintenance of the inspection instances, the internet sessions time out for some application instances. The application instances are not able to establish new sessions. Which combination of steps will remediate these issues? (Choose two.)

  • ADeploy one inspection instance in the Availability Zones that do not have inspection instances deployed.
  • BDeploy one additional inspection instance in each Availability Zone where the inspection instances are deployed. (correct answer)
  • CEnable the cross-zone load balancing attribute for the GWLB. (correct answer)
  • DDeploy inspection instances in an Auto Scaling group. Define a scaling policy that is based on CPU load.
  • EAttach the GWLB to all Availability Zones in the Region.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Deploy one additional inspection instance in each Availability Zone where the inspection instances are deployed. Option C: Enable the cross-zone load balancing attribute for the GWLB.

ANS-C01 Question 134

Single page →
Topic 1 · Question 134

A company has developed a new web application on AWS. The application runs on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate behind an Application Load Balancer (ALB) in the us-east-1 Region. The application uses Amazon Route 53 to host the DNS records for the domain. The content that is served from the website is mostly static images and files that are not updated frequently. Most of the traffic to the website from end users will originate from the United States. Some traffic will originate from Canada and Europe. A network engineer needs to design a solution that will reduce latency for end users at the lowest cost. The solution also must ensure that all traffic is encrypted in transit until the traffic reaches the ALB. Which solution will meet these requirements?

  • AConfigure the ALB to use an AWS Global Accelerator accelerator in us-east-1. Create a secure HTTPS listener. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the DNS name that is assigned to the accelerator for the ALB.
  • BConfigure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALConfigure the CloudFront distribution to use an SSL certificate. Set all behaviors to force HTTPS. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the DNS name that is assigned to the ALB.
  • CConfigure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALB. Configure the CloudFront distribution to use an SSL certificate and redirect HTTP to HTTPS. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to route to the CloudFront distribution. (correct answer)
  • DConfigure the ALB to use an AWS Global Accelerator accelerator in us-east-1. Create a secure HTTPS listener. Create a second application stack on Amazon ECS on Fargate in the eu-west-1 Region. Create another secure HTTPS listener. Create an alias record in Amazon Route 53 for the custom domain name. Configure the alias record to use a latency-based routing policy to route to the DNS name that is assigned to the accelerator for the ALBs.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure the ALB to use a secure HTTPS listener. Create an Amazon CloudFront distribution. Set the origin domain name to point to the DNS record that is assigned to the ALB. Configure the CloudFront distribution to u...

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins. Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance. This option delivers the requirement at the lowest cost.

ANS-C01 Question 135

Single page →
Topic 1 · Question 135 · Select all that apply

A company deploys an internal website behind an Application Load Balancer (ALB) in a VPC. The VPC has a CIDR block of 172.31.0.0/16. The company creates a private hosted zone for the domain example.com for the website in Amazon Route 53. The company establishes an AWS Site-to-Site VPN connection between its office network and the VPC. A network engineer needs to set up a DNS solution so that employees can visit the internal webpage by accessing a private domain URL (https://example.com) from the office network. Which combination of steps will meet this requirement? (Choose two.)

  • ACreate an alias record that points to the ALB in the Route 53 private hosted zone. (correct answer)
  • BCreate a CNAME record that points to the ALB internal domain in the Route 53 private hosted zone.
  • CCreate a Route 53 Resolver inbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver inbound endpoint. (correct answer)
  • DCreate a Route 53 Resolver outbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver outbound endpoint.
  • EOn the office DNS server, configure a conditional forwarder for the private domain to the VPC DNS at 172.31.0.2.
Reveal answer & explanation
Correct answer: A, C

The correct answer is A, C. Option A: Create an alias record that points to the ALB in the Route 53 private hosted zone. Option C: Create a Route 53 Resolver inbound endpoint. On the office DNS server, configure a conditional forwarder to forward the DNS queries to the Route 53 Resolver inbound endpoint.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 136

Single page →
Topic 1 · Question 136

A company is deploying AWS Cloud WAN with edge locations in the us-east-1 Region and the ap-southeast-2 Region. Individual AWS Cloud WAN segments are configured for the development environment, the production environment, and the shared services environment at each edge location. Many new VPCs will be deployed for the environments and will be configured as attachments to the AWS Cloud WAN core network. The company's network team wants to ensure that VPC attachments are configured for the correct segment. The network team will tag the VPC attachments by using the Environment key with a value of the corresponding environment segment name. The segment for the production environment in us-east-1 must require acceptance for attachment requests. All other attachment requests must not require acceptance. Which solution will meet these requirements?

  • ACreate a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag:Environment values to their respective segments.
  • BCreate a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1. Create a rule with a number of 200 that does not require acceptance to map any tag.Environment values to their respective segments. (correct answer)
  • CCreate a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value of Production and a Region value of us-east-1.
  • DCreate a rule with a number of 100 that does not require acceptance to map any tag:Environment values to their respective segments. Create a rule with a number of 200 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "or" value. Include conditions that require a tag:Environment value of Production or a Region value of us-east-1.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a rule with a number of 100 that requires acceptance for attachments to the production segment. In the rule, set the condition logic to the "and" value. Include conditions that require a tag:Environment value o...

ANS-C01 Question 137

Single page →
Topic 1 · Question 137

A company is migrating applications from a data center to AWS. Many of the applications will need to exchange data with the company's on-premises mainframe. The company needs to achieve 4 Gbps transfer speeds to meet peak traffic demands. A network engineer must design a highly available solution that maximizes resiliency. The solution must be able to withstand the loss of circuits or routers. Which solution will meet these requirements?

  • AOrder four 10 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate one connection from each Direct Connect location to a router at the company location. Terminate the other connection from each Direct Connect location to a different router at the company location. (correct answer)
  • BOrder two 10 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate the connection from each Direct Connect location to a different router at the company location.
  • COrder four 1 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate one connection from each Direct Connect location to a router at the company location. Terminate the other connection from each Direct Connect location to a different router at the company location.
  • DOrder two 1 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate the connection from each Direct Connect location to a different router at the company location.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Order four 10 Gbps AWS Direct Connect connections that are evenly spread over two locations. Terminate one connection from each Direct Connect location to a router at the company location. Terminate the other connecti...

Explanation

AWS Direct Connect provides a dedicated, consistent private network link between on premises and AWS. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

ANS-C01 Question 138

Single page →
Topic 1 · Question 138

A company has 10 web server Amazon EC2 instances that run in an Auto Scaling group in a production VPC. The company has 10 other web servers that run in an on-premises data center. The company has a 10 Gbps AWS Direct Connect connection between the on-premises data center and the production VPC. The company needs to implement a load balancing solution that receives HTTPS traffic from thousands of external users. The solution must distribute the traffic across the web servers on AWS and the web servers in the on-premises data center. Regardless of the location of the web servers, HTTPS requests must go to the same web server throughout the entire session. Which solution will meet these requirements?

  • ACreate a Network Load Balancer (NLB) in the production VPC. Create a target group. Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group Enable connection draining on the NLB
  • BCreate an Application Load Balancer (ALB) in the production VPC. Create a target group Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable application-based session affinity (sticky sessions) on the ALB. (correct answer)
  • CCreate a Network Load Balancer (NLB) in the production VPCreate a target group. Specify instance as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable session affinity (sticky sessions) on the NLB.
  • DCreate an Application Load Balancer (ALB) in the production VPC. Create a target group. Specify instance as the target type Register the EC2 instances and the on-premises servers with the target group Enable application-based session affinity (sticky sessions) on the ALB.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Application Load Balancer (ALB) in the production VPC. Create a target group Specify ip as the target type. Register the EC2 instances and the on-premises servers with the target group. Enable application-ba...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale.

ANS-C01 Question 139

Single page →
Topic 1 · Question 139 · Select all that apply

A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company has decided to use AWS Site-to-Site VPN to establish connectivity between its on-premises network and its AWS environment. The company does not have a static public IP address for its on-premises network. A network engineer must implement a solution to initiate the VPN connection on the AWS side of the connection for traffic from the AWS environment to the on-premises network. Which combination of steps should the network engineer take to establish VPN connectivity between the transit gateway and the on-premises network? (Choose three.)

  • AConfigure the Site-to-Site VPN tunnel options to use Internet Key Exchange version 1 (IKEv1).
  • BConfigure the Site-to-Site VPN tunnel options to use Internet Key Exchange version 2 (IKEv2). (correct answer)
  • CUse a private certificate authority (CA) from AWS Private Certificate Authority to create a certificate. (correct answer)
  • DUse a public certificate authority (CA) from AWS Private Certificate Authority to create a certificate.
  • ECreate a customer gateway. Specify the current dynamic IP address of the customer gateway device’s external interface.
  • FCreate a customer gateway without specifying the IP address of the customer gateway device. (correct answer)
Reveal answer & explanation
Correct answer: B, C, F

The correct answer is B, C, F. Option B: Configure the Site-to-Site VPN tunnel options to use Internet Key Exchange version 2 (IKEv2). Option C: Use a private certificate authority (CA) from AWS Private Certificate Authority to create a certificate. Option F: Create a customer gateway without specifying the IP address of the customer gateway device.

Explanation

AWS Site-to-Site VPN provides encrypted connectivity between on premises and a VPC. AWS Config tracks resource configuration changes and evaluates compliance.

ANS-C01 Question 140

Single page →
Topic 1 · Question 140 · Select all that apply

A company's AWS environment has two VPCs. VPC A has a CIDR block of 192.168.0.0/16. VPC B has a CIDR block of 10.0.0.0/16. Each VPC is deployed in a separate AWS Region. The company has remote users who work outside the company's offices. These users need to connect to an application that is running in the VPCs. Traffic to and from the VPCs over the internet must be encrypted. A network engineer must set up connectivity between the remote users and the VPCs. Which combination of steps should the network engineer take to meet these requirements with the LEAST management overhead? (Choose three.)

  • AEstablish an AWS Site-to-Site VPN connection between VPC A and VPC B.
  • BEstablish a VPC peering connection between VPC A and VPC B. (correct answer)
  • CCreate an AWS Client VPN endpoint in VPC A and VPC B Add an authorization rule to grant access to VPC A and VPC B.
  • DCreate an AWS Client VPN endpoint in VPC A Add an authorization rule to grant access to VPC A and VPC B. (correct answer)
  • EAdd a route to the AWS Client VPN endpoint’s route table to direct traffic to VPC B. (correct answer)
  • FAdd a route to the AWS Client VPN endpoint's route table to direct traffic to VPC A.
Reveal answer & explanation
Correct answer: B, D, E

The correct answer is B, D, E. Option B: Establish a VPC peering connection between VPC A and VPC B. Option D: Create an AWS Client VPN endpoint in VPC A Add an authorization rule to grant access to VPC A and VPC B. Option E: Add a route to the AWS Client VPN endpoint’s route table to direct traffic to VPC B.

Explanation

VPC peering privately connects two VPCs without a gateway.

Showing questions 121–140 of 292 · Page 7 of 15